Privacy Policy

Last updated: 17 September 2026

This policy explains what personal data Hanasay collects, why, and what rights you have over it. Hanasay is operated by Aperus Ltd (company no. 14340621) ("Aperus", "we", "us", "our"), which is the data controller for the information described here.

1. What we collect

We only collect what the app itself needs to work. Specifically:

Account data — your email address, and a securely hashed password if you sign up that way (we never see or store your password in plain text; this is handled by our authentication provider, Supabase Auth). If you sign in with Apple or Google, we receive the identifier and email address they share with us for that purpose.
Profile and preferences — an optional display name, and app preferences such as whether intro screens or auto-advance are turned on.
Learning activity — per-exercise attempt counts, correct/incorrect answers, which items you've starred or missed for revision, and your replay history. This is what powers your progress tracking, star ratings, and revision suggestions — it exists only to make the app work for you.
Subscription status — whether you currently have an active Hanasay Premium subscription, and enough transaction metadata to confirm that. We do not receive or store your card number or other payment details at any point — Apple or Google processes the payment and tells us only whether you're entitled to Premium content.

What we don't collect: Hanasay has no advertising SDK and no analytics/tracking SDK of any kind — there's nothing in the app watching your behaviour for ad targeting or cross-app tracking, because nothing like that is built into it.

2. How we use it

We use your data only to:

Provide the app itself — sign you in, save and show your progress, power revision and star ratings, and unlock Premium content you've paid for;
Maintain the security of your account and the service;
Respond to support requests you send us.

We don't sell your data, and we don't use it for advertising — ours or anyone else's.

3. Who we share it with

We use a small number of service providers to run Hanasay. Each only receives what it needs to perform its specific role:

Supabase — hosts our database and handles authentication on our behalf, as our data processor. Your account and learning data described in Section 1 lives on Supabase's infrastructure.
Apple — if you use Sign in with Apple, or if you subscribe on iOS, Apple processes that sign-in and/or payment independently, under its own privacy policy.
Google — if you use Google Sign-In, or subscribe on Android, Google processes that sign-in and/or payment independently, under its own privacy policy.

We don't share your data with any other third party, and we don't have any advertising or analytics partners to share it with in the first place.

4. Security

All traffic between the app and our servers is encrypted in transit (HTTPS/TLS). Your data is protected by row-level security rules on our database that restrict every learner's data to that learner alone — another user's account, however it were compromised, cannot read or write your rows.

5. How long we keep it, and deleting your data

We keep your account and learning data for as long as your account exists. You can permanently delete your account at any time from Account → Delete account inside the app. This is a real, immediate, hard delete — not a deactivation — and it automatically removes every record tied to your account (your learning stats, revision pool, replay history, and profile) along with it. We don't retain a copy after deletion.

6. Your rights

If you're in the UK or EU, you have rights under UK/EU data protection law, including the right to:

Access the personal data we hold about you;
Correct inaccurate data (most of this you can already edit yourself in Account settings);
Erase your data — see Section 5 for the in-app self-service way to do this immediately;
Object to or restrict certain processing;
Receive a copy of your data in a portable format;
Complain to your local data protection authority (in the UK, the Information Commissioner's Office) if you think we've mishandled your data.

To exercise any of these rights beyond what's available directly in the app, contact us at privacy@hanasay.app.

7. Children's privacy

Hanasay is not directed at children under 13, and we don't knowingly collect personal data from anyone under that age. If you believe a child has provided us with personal data, contact us at privacy@hanasay.app and we'll delete it.

8. International data transfers

Our service providers may process data outside the country you're in. Where that involves a transfer out of the UK or EU, we rely on the safeguards those providers make available (such as Standard Contractual Clauses) to protect it.

9. Changes to this policy

We may update this policy from time to time — for example, if we add a new feature that changes what data we collect. We'll update the "Last updated" date above when we do.

10. Contact

Aperus Ltd
128 City Road, London, United Kingdom, EC1V 2NX
Email: privacy@hanasay.app